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(54) TRAFFIC GATHERING AND ANALYZING SYSTEM 

(57)Abstract: 

PROBLEM TO BE SOLVED: To provide a traffic 
gathering/analyzing system capable of gathering and <»-■ 
analyzing traffic without omission in the transmission line 
of a wide band even at the time of using a traffic 
gathering/analyzing device with insufficient throughput. 
SOLUTION: This system is provided with the plural 
traffic gathering/ analyzing devices (personal computers 
PC1-PC3) connected on the same network segment and 
respectively provided with traffic gathering/analyzing 
means (gathering objects 1-3) and a partial charge 
adjustment means (adjustment object or the like) for 
adjusting partial charges in the traffic 
gathering/analyzing means. By the partial charge 
adjustment means, the respective traffic gathering/ 
analyzing means are made to take the partial charges of 
the traffic on the network segment without the omission 
and gather and analyze it. 




* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1. This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2. **** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 



CLAIMS 



[Claim(s)] 
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[Claim 1]Two or more traffic collection and analysis apparatus in which it is connected on the 
same network segment and each possesses traffic collection and tools of analysis 
A partial charge adjustment means which adjusts an assignment in said traffic collection and 
tools of analysis. 

Are traffic collection and an analyzing system provided with the above, take and spill traffic on 
said network segment by said partial charge adjustment means to said traffic collection and tools 
of analysis, and it is made to assign that there is nothing, and is made to collect and analyze. 

[Claim 2]In traffic collection and the analyzing system according to claim 1, said partial charge 
adjustment means, While each of said traffic collection and analysis apparatus decide beforehand 
that the attribute of a packet which should be collected and analyzed is taken and ****** does 
not occur, Traffic collection and an analyzing system being a means which detects and removes 
a packet which this overlaps when the same packets are being collected by two or more of said 
traffic collection and analysis apparatus. 

[Claim 3]Traffic collection and an analyzing system characterized by the attribute of said packet 
being time for this packet to pass a network segment in traffic collection and the analyzing 
system according to claim 2. 

[Claim 4]Traffic collection and an analyzing system characterized by the attribute of said packet 
being the information written in a header of this packet in traffic collection and the analyzing 
system according to claim 2. 

[Claim 5]In traffic collection and the analyzing system according to claim 1, said partial charge 
adjustment means, While adjusting an assignment dynamically so that it may communicate and 
take mutually and ****** may not occur after each traffic collection and analysis apparatus 
start collection, Traffic collection and an analyzing system being a means which detects and 
removes a packet which this overlaps when the same packets are being collected by two or 
more of said traffic collection and analysis apparatus. 

[Claim 6]In traffic collection and the analyzing system according to claim 5, dynamic adjustment 
of an assignment by said partial charge adjustment means, Frequency beforehand decided for 
every traffic collection and tools of analysis is made to share traffic processing, Traffic 
collection and an analyzing system shifting mutually an order of traffic treated by traffic 
collection and tools of analysis of this plurality when processing of the same traffic overlaps in 
two or more traffic collection and tools of analysis. 



[Translation done.] 
* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

LThis document has been translated by computer. So the translation may not reflect the original 
precisely. 

2.**** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 



DETAILED DESCRIPTION 



[Detailed Description of the Invention] 
[0001] 

[Field of the Invention]In this invention, load is especially distributed about the traffic collection 
and the analyzing system for performing traffic management in computer networks, such as the 
Internet. 
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Therefore, while making two or more low cheap machines of throughput cooperate and realizing 
high throughput, it takes and spills in a broadband transmission line, and is related with the traffic 
collection and the analyzing system it was made not to have **. 

[0002] 

[Description of the Prior Art]The packets which flow on a network are collected, and in traffic 
management of computer networks, such as the Internet, it is necessary to analyze them, to 
create various statistical datas or to save the contents of a packet depending on the case. As 
creation of a statistical data, there is creation of statistical information, such as the place of 
dispatch of a packet and a packet number according to mail arrival place, and there are 
preservation of the TCP/IP header of a packet, etc. as preservation of a packet, for example. 
[0003]RMON (Remote network MONitoring) and RMON2 exists as a standard of the interface for 
accessing a collection item and the collected data in traffic collection. That to which the product 
for traffic collection and analysis in recent years was based on these standards occupies most. 
It is as follows when the traffic collection and analytical method based on RMON and RMON2 are 
classified. 

The conventional method 1: How to collect with network equipment, such as a router and a hub 
(line concentrator). 

The conventional method 2: How to collect by traffic collection and an analysis apparatus 
(probe). 

Here with traffic collection and an analysis apparatus (probe). All the packets on a segment are 
investigated, it is analyzed and things, such as the dedicated hardware and the workstation which 
statistical information is created, or can save a packet so that it can analyze later, or PC 
(personal computer), are said. 
[0004] 

[Problem(s) to be Solved by the Invention]Generally, traffic collection and analysis are high 
processings of load, and the above-mentioned conventional methods 1 and 2 cannot necessarily 
say it as an effective method. Namely, since (1) traffic collection and analysis are high 
processings of load, It is difficult to make traffic collection processing that such loads are high 
perform to network equipment, such as a router and a hub (line concentrator), like the above- 
mentioned conventional method 1 in addition to original work (routing processing in the case of a 
router, etc.), in view of the throughput. It seems that the method of the conventional method 1 
becomes increasingly effective less since it is expected that a network will be a broadband 
increasingly from now on. 

(2) It seems that that the throughput of traffic collection and an analysis apparatus does not 
catch up occurs also by the method of the above-mentioned conventional method 2 using traffic 
collection and an analysis apparatus for exclusive use (probe). The fact that traffic collection and 
analysis processing will be a heavy load further in the future — that the network has broadband- 
ized and traffic collection and an analytical item are various — is cited as the reason. 
[0005](3) Even if it has the ability for traffic collection and an analysis apparatus to perform 
traffic collection and analysis processing of a specific network, when using traffic collection and 
an analysis apparatus, there is a problem that great cost will start. As the reason, in order to 
require high processing of load, traffic collection and analysis, It is because it is necessary to use 
highly efficient traffic collection and analysis apparatus (probe) and each traffic collection and 
analysis apparatus (probe) become expensive in connection with it in a transmission line 
[ broadband / backbone / (trunk-line data service network) ]. In order to avoid it, when the 
traffic collection and the analysis apparatus (probe) whose throughput is not enough are used, 
collection and analysis processing can be performed to no packets, but it takes, ****** occurs, 
and the problem that it is not obtained generates exact statistics. 

[0006](4) Further, on the Internet, in order to distribute generally without traffic's concentrating 
on a specified part, the installed number of traffic collection and an analysis apparatus increases. 
Therefore, the cost of each traffic collection and analysis apparatus poses a big problem. The 
purpose of this invention is to provide the traffic collection and the analyzing system which it 
takes and spills in a broadband transmission line, and can collect and analyze traffic that there is 
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nothing, even if it uses the traffic collection and the analysis apparatus for which throughput was 

insufficient, in order to solve these problems. 

[0007] 

[Means for Solving the Problem]To achieve the above objects, traffic collection and an analyzing 
system of this invention, Two or more traffic collection and analysis apparatus (for example, 
personal computer PC) in which it is connected on the same network segment and each 
possesses traffic collection and tools of analysis (a collection object, a collection process), Have 
a partial charge adjustment means which adjusts an assignment in said traffic collection and 
tools of analysis (a collection object, a collection process), and by a partial charge adjustment 
means. It is characterized by taking and spilling traffic on a network segment to each traffic 
collection and tools of analysis, making it assign that there is nothing, and making it collect and 
analyze. 

[0008]While deciding beforehand that said partial charge adjustment means takes the attribute 
(time for a packet to pass a network segment, information written in a header of a packet) of a 
packet which each traffic collection and analysis apparatus should collect and analyze, and 
****** does not generate it, When the same packets are being collected by two or more traffic 
collection and analysis apparatus, it is characterized by being what detects and removes a 
packet which this overlaps (examples 1 and 2: a partial charge adjustment means is equivalent to 
a function of a part of comparison object or collection object in this case). 
[0009]While said partial charge adjustment means adjusts an assignment dynamically so that it 
may communicate and take mutually and ****** may not occur after each traffic collection and 
analysis apparatus start collection (even one side is adjusted with ******), When the same 
packets are being collected by two or more of said traffic collection and analysis apparatus, it is 
characterized by being what detects and removes a packet which this overlaps (example 3: a 
partial charge adjustment means is equivalent to an adjustment object in this case). 
[0010] 

[Embodiment of the Invention]The suitable embodiment of this invention has the following basic 
constitution. 

** Install two or more traffic collection and analysis apparatus on the same segment of the 
network which conducts traffic collection and analysis. 

** Operate the process (collection process) of conducting collection and analysis of traffic on 
each traffic collection and analysis apparatus. 

** The packet which conducts collection and analysis is assigned to each collection process, 

and each collection process carries out collection and analysis for the packet which flows into a 

measuring object segment to it selectively according to the assignment. 

** Total the traffic data collected and analyzed in each collection process. 

[001 1]The following method is used as assignment of the packet which each collection process 

in the above-mentioned ** collects and analyzes. 

(a) How (how to opt for the assignment statically beforehand) to opt for assignment of the 
packet which each collection process collects and analyzes beforehand. There are a method of 
assigning beforehand the time zone which collects packets for every collection process as an 
example in this case, the method of assigning beforehand the attribute (it is a protocol etc. for 
example, it is written in a header) of the packet which should be collected for every collection 
process, etc. 

(b) How (how to adjust an assignment dynamically working and to opt for it) to opt for an 
assignment by communicating mutually and adjusting between collection processes after each 
collection process starts. There is a method of opting for assignment of the packet which should 
be collected between collection processes dynamically referring to the arrival order foreword of 
the arriving packet as an example in this case. 

[0012](division of roles and its effect) As a method of assigning the packet which should be 
collected in each collection process, ** mentioned above has "the method of opting for the 
assignment beforehand", and "a method of adjusting and opting for an assignment." 
(a) The packet which should be collected in each collection process is beforehand opted for 
assignment, and method" which opts for "assignment beforehand is made to share a role. 
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According to this method, the load per traffic collection and analysis apparatus is reduced, and it 
becomes possible to collect and analyze all the traffic as a whole. 

(in b) "method of adjusting and opting for an assignment", assignment of each collection process 
is dynamically changed during packet collection. Since the load of each traffic collection and 
analysis apparatus can be changed easily according to this method, scalability can be made high. 
[0013](Take and spill) Since the role of each collection process is assigned so that picking 
****** may not occur, if data is totaled from each collection process, the traffic data of the 
segment can be created. 

[0014]Hereafter, the example of this invention is described in detail using a drawing. In this 
invention, methods of sharing the role of packet collection with each collection process include 
"the method of opting for the assignment beforehand", and "the method of adjusting and opting 
for an assignment." It is considered as "the method of opting for the assignment beforehand", 
and there are "method of opting for an assignment by the pass time of a packet", and "method 
of opting for an assignment with the header attribute of a packet." The case where "the method 
of adjusting and opting for an assignment" is used for the case where "the method of opting for 
an assignment with the header attribute of a packet" is hereafter used for the case where "the 
method of opting for an assignment by the pass time of a packet" is used as Example 1 , as 
Example 2, as Example 3 is explained. 
[0015](Example 1) 

The explanatory view 1 of an example using "the method of opting for an assignment by the pass 
time of a packet" is a figure explaining the example which used "the method of opting for an 
assignment by the pass time of a packet." "The method of opting for an assignment by the pass 
time of a packet" is a method of opting for an assignment by assigning the time zone which 
synchronizes time between each traffic collection and analysis apparatus, and collects traffic in 
each collection process (collection object). That is, each collection process (collection object) is 
decided to perform collection and analysis processing only about the packet which passed the 
segment within the assigned time zone. 

[0Q16]D rawing 1 (a) receives 100M Ethernet (registered trademark) (Ethernet of the specification 
which can be used by 100M bit per second), On three-set [ of PCs ] (personal computer), and 
personal computer PC1, PC2, and PC3, The example in the case of operating one collection 
object which communicates on a general-purpose distributed object plat form, and conducting 
traffic collection and analysis is shown, Between each personal computer PC, it is assumed that 
the time synchronization accuracy was guaranteed to be is performed using NTP (Network Time 
Protocol) etc. Suppose that the collection object 1 exists in personal computer PC1, the 
collection object 2 exists in personal computer PC2, and the collection object 3 exists in 
personal computer PC3. 

[001 7](Composition of a collection object) Dr awin g 2 is a block diagram showing the internal 
configuration of each collection objects 1-3. As for 20, in the figure, a primary buffer and 24 are 
memory measures a collection object and 22. The memory measure 24 may be, the database 
(DB) (Management InformationBase), i.e., MIB, of network management information which were 
standardized with the TCP/IP protocol. 21 shows the process treatment 1 which saves up a 
packet to the primary buffer 22, and 24 processes the packet saved up to the primary buffer 22, 
and shows the process treatment 2 which creates various statistical datas or saves the created 
various statistical datas and a packet at the memory measure 24. 

[001 8] Drawing 1 (b) is a figure showing the activity of each collection object 1-3 of the three 
personal computers PC1-PC3 along a time-axis top. In the figure, (b) shows "continuation 
collection time" and (**) shows "processing time." To the primary buffer 22, "continuation 
collection time" is the packet which passes the segment concerned time (time for the process 
treatment 1 to operate) to save up, and with "processing time." Various statistical datas are 
created from the collected packets, or time (time for the process treatment 2 to operate) to 
perform a packet and created preservation of a statistical data is expressed (refer to drawing 2 ). 
[0019]Division of roles in this example is performed by assigning "continuation collection time" 
to each collection objects 1-3. In this case, if the synchronization between each continuation 
collection time is not exact, it will take at the time of a change and ****** will occur. In order to 
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prevent this, only the part of the accuracy of a synchronization needs to give a margin, i.e., a lap, 
between [ of each collection object ] continuation collection time. 
[0020]The capacity of the primary buffer 22 of the collection object in this example is 
determined that it will fulfill the conditions of (1) type. 

Accuracy x2 of the time synchronization by which the zone x guarantee of the capacity > 
measuring object transmission line of a primary buffer was done ... (1) type[0021]This reason is 
explained using continuation collection time (b) of drawing 1 G>), and processing time (**). In 
drawing 1 , (X) expresses the lap time (grade of a synchronization) between each collection 
object, and (Y) expresses continuation collection time (b).These (X) and (Y) are determined as 
follows. 

** Determine determining method (X) of (X) as follows. 

(X)= accuracy of the guaranteed time synchronization ... the method (Y) of determining (2) type 
** (Y) expresses 1 time of continuation collection time (b) of the collection object. This 
continuation collection time needs to fulfill the conditions of following the (3) type at least. 
(Y) — >(X)x2 ... (3) types — here — continuation collection time (Y) — The zone of the 
capacity / measuring object transmission line of a continuation collection time = primary buffer ... 
it is expressed with (4) types. (3) It turns out that it is necessary to fulfill the conditions of a 
formula, and the conditions of (4) types to the above-mentioned (1) formula. 

[0022]From the above-mentioned (1) formula, the capacity of a primary buffer can be determined 
in consideration of the zone of a measuring object transmission line, and the guaranteed 
accuracy of a time synchronization. For example, in the transmission line of 100M bps, when the 
synchronous accuracy for 10 ms is obtained. (X)= 10 ms ... (5) types (Y) >20ms ... in order to 
become (6) types and to fill (6) types, it turns out that what is necessary is just to prepare the 
primary buffer more than 2000K bits, i.e., a 250 K byte (= 2000/8) K bit. 
[0023]The following thing becomes possible by taking the above composition. 
** Within a time [ to which each collection object was assigned ] is continuously collectable 
(continuation collection). 

** Take, when changing a role between each PC, and ****** does not occur. 

[0024](The total method of data) How to ask for the set union of the information which each 

collection object collected is shown below. 

(A) Save the packets collected by each collection object between parts for accuracy, i.e., time 
(X) currently overlapped and collected, of a synchronization. 

(B) Compare the packet which it overlapped and were collected between (X)s between the 
collection objects currently collected, and ask for a duplicate packet. 

(C) Overlap, conduct the same analysis as the collected packets to the packet currently 
collected, and save analytical data. 

(D) Deduct the saved analytical data from the sum of data collected by the collection objects 1 
and 2. 

[0025]The comparison processing of the above (B), and analysis and storage processing of the 
packet which the above (C) overlaps and are collected have two kinds, the method of carrying 
out which it takes charge of by the object (it is henceforth called a comparison object) provided 
in its exclusive use, and the method which each collection object takes charge of. Hereafter, 
each is described. 

** Provide the comparison object only for a method which provides a comparison object for 
exclusive use, and make this comparison object take charge of the comparison processing of the 
above (B), and analysis and storage processing of (C). Each collection object sends the packets 
collected between (X)s to a comparison object. In a comparison object, the data between the 
objects currently overlapped and collected is compared, a duplicate packet is computed, and 
analysis and storage processing of the above (C) are performed. 

[0026]** Take charge of the comparison processing of the method above (B), and the analysis 
and storage processing of (C) with which each collection object compares only in one collection 
object of the two collection objects which overlap and are collecting packets. At this time, it 
overlaps and the collection object of another side of the two collection objects currently 
collected sends the packets collected during the (X) to above-mentioned one [ which takes 
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charge of the comparison processing of (B), and analysis and storage processing of (C) ] 
collection object. It is made, as for how to choose above-mentioned one [ which takes charge of 
the comparison processing of (B), and analysis and storage processing of (C) ] collection object, 
for load to distribute as much as possible. In the case of d rawing 1 which consists of three 
collection objects, For example, comparison of the packets collected by the collection object 1, 
and the packets collected by the collection object 2 the collection object 1, The collection 
object 3 is made to perform comparison of the packet in which the collection object 2 collected 
comparison of the packets collected by the collection object 2, and the packets collected by the 
collection object 3 by the collection object 3, and the packets collected by the collection object 
1 , respectively. 

[0027]Next, when overlapping and collecting between the collection object 1 and the collection 
object 2, how to ask for the packet number which passed the segment of the collection object is 
shown. Packet number p for which it asks is as follows. 

p=x+y-z — here, recovery of the packet number data which was collected by the packet number 
yrcollection object 2 collected by x:collection object 1 and which was collected by carrying out 
packet number z:duplication, When the dedicated line for control can be prepared, it is 
satisfactory, but when it is impossible, the network which conducts traffic collection and analysis 
is used. In that case, in order to reduce the load to the network which conducts traffic collection 
and analysis, data is compressed and sent out. 

[0028]Since composition which was mentioned above is adopted according to this example, it 
becomes possible to distribute load by two or more traffic collection and analysis apparatus, and 
to conduct traffic collection and analysis. Even if it is low PC of throughput in this example, it is 
available by shortening time to collect traffic and lengthening processing time. 
[0029](Example 2) 

Although it is possible to opt for the assignment of a collection object in a protocol, a source 
address, a destination address, etc. by explanation "method of opting for an assignment with the 
header attribute of a packet" of the example using "the method of opting for an assignment with 
the header attribute of a packet", It is considered [ that load may incline greatly by generating of 
the load by a single user, and ] on the Internet. For utilization, it is required to use the attribute 
which a bias does not generate, and the method of distributing load by ID identifier, a header 
checksum, etc., etc. are considered. In this case, determination of an assignment which a bias 
does not produce for load very much for a short time is needed. 

[0030]In sharing a role using ID identifier, a header checksum, etc., unlike the case of the above- 
mentioned Example 1, it does not produce duplication in the packets collected by each collection 
object this — supposing in 1 bit of the last of ID identifier the collection object 2 collected the 
things of "0" and 1 bit of the last of ID identifier collects the things of "1", the collection object 
1, Considering the example that it is lost that duplication arises in the packets collected by the 
collection objects 1 and 2, it is clear. Therefore, what is necessary is just to only take the sum of 
the data of each collection object, in calculating a statistic. Recovery of data uses the same 
method as Example 1 . 

[0031] According to this example, it becomes possible to distribute load by two or more general 
purpose computers, and to conduct collection and analysis of traffic. Even when low PC of 
throughput is used, it becomes available what the quantity of the collection packet of the PC is 
reduced for (the lower 2 figure of ID identifier collects the things of "00"). 
[0032](Example 3) 

The explanatory view 3 of an example using "the method of adjusting and opting for an 
assignment" is a figure for describing the example of "the method of opting for an assignment 
based on an arrival order foreword" as an example of "the method of adjusting and opting for an 
assignment." "The method of opting for an assignment based on an arrival order foreword" is a 
way each collection object opts for an assignment dynamically using the arrival order foreword 
information on a segment. That is, each collection object is the method of collecting and 
analyzing in order the packet which arrives one after another. The arrival order foreword of the 
packet within the same segment can apply this method to the same thing like the shared media 
of a multiple access. The cooperation (adjustment) mechanism for not collecting the same 
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packets between each collection object in this method is indispensable. 

[0033]Since order information is not included in the packet itself, the reason is because the 
packet which should be collected by each collection object is not known. For example, when two 
collection objects collect mutually in every other packet, suppose that the same packets were 
collected by both collection objects. An adjustment object is provided, these are supervised, and 
when it is detected that the same packets were collected by both collection objects, the method 
of directing to shift one packet collected to collection object of one of the two can be 
considered. 

[0034]In drawing 3 , to 100M Ethernet, traffic collection and analysis are conducted using two 
personal computers, and one collection object which communicates on a general-purpose 
distributed object plat form is operated on each personal computer. An adjustment object is 
operated with one of personal computers. The example of drawin g 3 (a) shows the case where 
the collection object 1 and an adjustment object are operated on personal computer PC1, and it 
operates the collection object 2 on personal computer PC2. 
[0035](Explanation of operation) ' 
** Determine frequency n/m of the packet collected for every collection object according to the 
throughput of each PC before starting (n and m are natural numbers). Frequency n/m means 
collecting n packets of them correctly, when m packet arrives. The case of the frequency 2/5, 
i.e., n= 2, and m= 5 is made into an example, and this operation is shown in drawing 4. drawing 4 - 
- packet p (1), p (2), p (3), and ... p (5a+1), p (5a+2), and p (5a+3) — in a collection object, 
when ... arrives, two fifths of the packets of them, i.e., p, (1), p (3), and ... it means collecting p 
(5a+1), p (5a+3), and ... 

[0036]** Start each collection object simultaneously, and from arbitrary packets, it starts 
collection and collects n packets to m packet. 

** After each collection object starts collection, an adjustment object investigates the packet 
which is collecting each collection objects. 

** When two or more collection objects are collecting the same packets, calculate the 
adjustment method for each collection object, and take out directions to a collection object. In 
calculation of an adjustment method, in order to take and to lose ******, it is calculated how the 
packet which each collection object collects should be shifted. 
[0037](Deciding method of frequency n/m of the packet to collect) 

** Set n of the collection object on PC with the lowest throughput to 1 among PCs used for 
collection, and determine m suitable for capability. 

** The collection object of other PCs determines n suitable for throughput using m determined 
by the above-mentioned **. 

The number of PC is prepared so that the sum of n assigned to each collection object may 
become more than m. 

[0038]This structure is concretely explained using drawing 3. 
** Set the collection objects 1 and 2 to n= 1 and m= 2. 

** Assume that two collection objects are collecting the same packet p (1), p (3), and p (5) by 
chance at the time of starting (refer to dra wing 3 (b)). 

** Investigate the packet in which the adjustment object is collecting each collection objects 1 
and 2, trace that two collection objects are collecting the same packets, and issue directions so 
that one packet collected to the collection object 2 may be shifted. 

** The collection object 1 continues collection in the same order as it or before (p (7), p (9), p 
(1 1), ...). On the other hand, as for a collection object, the one collection object 2 collects packet 
p (8) shifted one, p (10), and ... after it according to the directions to shift. It takes 
[ subsequent ], and spills and ** becomes thus, is not less by shifting every one packet collected 
by one collection object (refer to drawing 3 (c)). 

[0039](Data total) In the case of this example, after adjustment is completed, the duplication of 
data is not produced. Therefore, what is necessary is just to only take the sum of the data of 
each collection object, in calculating a statistic. Recovery of data takes the same method as 
Example 1. 

[0040]According to this example, it becomes possible to distribute load by two or more general 
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purpose computers, and to conduct collection and analysis of traffic by composition like the 
above. Also when load is distributed with low PC of throughput, it becomes available what 
collection service frequency of the packet of the PC is made small for (for example, ten PCs are 
prepared and each collects to ten packets [ one ]). 
[0041] 

[Effect of the Invention]According to this invention, by carrying out two or more set coordination 
operation, low PC (personal computer) of throughput also writes traffic collection and analysis as 
it is possible, and it can reduce the cost of traffic collection and analysis (reduction of cost). 
Since scalability is high, even when a zone increases, it can respond easily by increasing the 
number of a general purpose computer (the correspondence to a spread spectrum transmission 
way is possible). 



[Translation done.] 
* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

LThis document has been translated by computer. So the translation may not reflect the original 
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DESCRIPTION OF DRAWINGS 



[Brief Description of the Drawings] 

[Drawing 1] It is a figure showing the system configuration of Example 1 of this invention, and the 
example of each collection object of operation. 

[Drawing 2 ]It is a figure showing the example of composition of the collection object of Example 

1 of this invention. 

[Drawing 3]It is a figure showing the system configuration of Example 3 of this invention, and the 
example of each object of operation. 

[ Drawing 4 ] In Example 3 of this invention, it is a figure showing the example of each collection 
object in case the collection service frequency of a packet is 2/5 of operation. 
[Description of Notations] 

20: A collection object, the 21 process treatment 1, 22:primary buffer, the 23:process treatment 

2 and 24 : memory measure (MIB;Management Information Base) 



[Translation done.] 
* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1 This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2.**** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 
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